ipsec passthrough

Hi Redhatsup, From an earlier post, you can check using the CLI: # get config [...] set firewall passthru ipsec disable set vpn ipsec unknown_spi disable [...] (see http://support.fortinet.com/forum/post.asp?do=reply&messageID=6514&smode=1&tmode=1&p=2&toStyle=m) - Steve

Rats... the link should be: http://support.fortinet.com/forum/m.asp?m=1355&p=2&tmode=1&smode=1&key=&language=

Does anyone have an answer to this question?

Syntax is different in 2.8, so this is incorrect. Also strangely this feature doesnt even exist anymore in the later revisions of firmware. I cannot remember which was the last revision that still had it in (its mentioned somewhere in this forum) think it was 2.8 MR6 ?? However, IPSec should pass through the unit anyway, if it doesnt work for you, its probably the NAT that is breaking it. You need a remote firewall (that you are connecting to) and a VPN client that BOTH support NAT-Traversal. What are you trying to get working ?

I would like to set up a VPN site-to-site between 2 fortigates but have 2 other fortigates in between. ie: SubA -> Forti1 -> SubB -> Forti2 -> Internet -> Forit3 -> SubC -> Forti4 -> SubD I can create a VPN between Forti2 & Forti3 no probs but would like to create a VPN between Forti1 & Forti4 so Forti2 & Forti3 have to passthru the IPSEC

As long as NAT Traversal is turned on for the VPN configurations of the firewalls at the ends of the tunnel, should work fine. If it doesnt, its probably a routing issue instead. Otherwise couldnt you just vpn between 2 and 3 instead ?